diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..8538812 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,17 @@ +# top-most EditorConfig file +root = true + +# Unix-style newlines with a newline ending every file +[*] +charset = utf-8 +trim_trailing_whitespace = true +end_of_line = crlf +insert_final_newline = true + +# Tab indentation (no size specified) +[Makefile] +indent_style = tab + +[*.{c,h,cpp,hpp}] +indent_style = space +indent_size = 4 diff --git a/Domito.sln b/Domito.sln index 0bb66ce..b2990e5 100644 --- a/Domito.sln +++ b/Domito.sln @@ -5,6 +5,14 @@ VisualStudioVersion = 17.6.33723.286 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Domito", "src\Domito.vcxproj", "{949657C4-92F7-48A5-90DD-02B4709AA6BF}" EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{C52A96B3-00CD-40C6-8648-DE141DF2559D}" + ProjectSection(SolutionItems) = preProject + .editorconfig = .editorconfig + .gitignore = .gitignore + LICENSE = LICENSE + README.md = README.md + EndProjectSection +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM64 = Debug|ARM64 diff --git a/Domito.sln.DotSettings b/Domito.sln.DotSettings index e94b454..710b574 100644 --- a/Domito.sln.DotSettings +++ b/Domito.sln.DotSettings @@ -1,3 +1,4 @@  True + True True \ No newline at end of file diff --git a/include/Domito.h b/include/Domito.h index df385df..ac3f448 100644 --- a/include/Domito.h +++ b/include/Domito.h @@ -3,63 +3,75 @@ // Structure representing a loaded module typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY { - PVOID Unknown1; - PVOID Unknown2; - PVOID Base; - ULONG Size; - ULONG Flags; - USHORT Index; - USHORT NameLength; - USHORT LoadCount; - USHORT PathLength; - CHAR ImageName[256]; -} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY; + PVOID Unknown1; + PVOID Unknown2; + PVOID Base; + ULONG Size; + ULONG Flags; + USHORT Index; + USHORT NameLength; + USHORT LoadCount; + USHORT PathLength; + CHAR ImageName[256]; +} SYSTEM_MODULE_INFORMATION_ENTRY, * PSYSTEM_MODULE_INFORMATION_ENTRY; // Structure representing the loaded module information typedef struct _SYSTEM_MODULE_INFORMATION { - ULONG Count; - SYSTEM_MODULE_INFORMATION_ENTRY Module[1]; -} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; + ULONG Count; + SYSTEM_MODULE_INFORMATION_ENTRY Module[1]; +} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION; // Function prototype for ZwQuerySystemInformation NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation( - ULONG SystemInformationClass, - PVOID SystemInformation, - ULONG SystemInformationLength, - PULONG ReturnLength + ULONG SystemInformationClass, + PVOID SystemInformation, + ULONG SystemInformationLength, + PULONG ReturnLength ); typedef struct _LDR_DATA_TABLE_ENTRY { - LIST_ENTRY64 InLoadOrderLinks; - PVOID ExceptionTable; - ULONG ExceptionTableSize; - PVOID GpValue; - PVOID NonPagedDebugInfo; - PVOID ImageBase; - PVOID EntryPoint; - ULONG SizeOfImage; - UNICODE_STRING FullImageName; - UNICODE_STRING BaseImageName; - ULONG Flags; - USHORT LoadCount; - USHORT TlsIndex; - LIST_ENTRY64 HashLinks; - PVOID SectionPointer; - ULONG CheckSum; - ULONG TimeDateStamp; - PVOID LoadedImports; - PVOID EntryPointActivationContext; - PVOID PatchInformation; -} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + LIST_ENTRY64 InLoadOrderLinks; + PVOID ExceptionTable; + ULONG ExceptionTableSize; + PVOID GpValue; + PVOID NonPagedDebugInfo; + PVOID ImageBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullImageName; + UNICODE_STRING BaseImageName; + ULONG Flags; + USHORT LoadCount; + USHORT TlsIndex; + LIST_ENTRY64 HashLinks; + PVOID SectionPointer; + ULONG CheckSum; + ULONG TimeDateStamp; + PVOID LoadedImports; + PVOID EntryPointActivationContext; + PVOID PatchInformation; +} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY; -typedef PVOID (NTAPI* t_RtlImageDirectoryEntryToData)( - IN PVOID Base, - IN BOOLEAN MappedAsImage, - IN USHORT DirectoryEntry, - OUT PULONG Size +typedef PVOID(NTAPI* t_RtlImageDirectoryEntryToData)( + IN PVOID Base, + IN BOOLEAN MappedAsImage, + IN USHORT DirectoryEntry, + OUT PULONG Size + ); + + +typedef +_IRQL_requires_same_ +_Function_class_(DOMITO_ALLOCATE_ROUTINE) +__drv_allocatesMem(Mem) +PVOID +NTAPI +DOMITO_ALLOCATE_ROUTINE( + _In_ SIZE_T ByteSize ); +typedef DOMITO_ALLOCATE_ROUTINE* PDOMITO_ALLOCATE_ROUTINE; _Success_(return == STATUS_SUCCESS) @@ -68,8 +80,8 @@ _IRQL_requires_max_(PASSIVE_LEVEL) EXTERN_C NTSTATUS DomitoFindDriverBaseAddress( - _In_ STRING ModuleName, - _Inout_opt_ PVOID* ModuleBase + _In_ STRING ModuleName, + _Inout_opt_ PVOID * ModuleBase ); _Success_(return == STATUS_SUCCESS) @@ -78,7 +90,7 @@ _IRQL_requires_max_(PASSIVE_LEVEL) EXTERN_C NTSTATUS DomitoFindExportedFunctionAddress( - _In_ PVOID ModuleBase, - _In_ STRING FunctionName, - _Inout_opt_ PVOID* FunctionAddress + _In_ PVOID ModuleBase, + _In_ STRING FunctionName, + _Inout_opt_ PVOID * FunctionAddress );